I haven't checked for new groups on your server for a while. Some nice
recent adds. Good work and thanks!

Am 29.11.2023 um 09:08:12 Uhr schrieb rob:

> Some nice recent adds.

Wich groups were added?

Marco Moock in alt.free.newsservers:

>Am 29.11.2023 um 09:08:12 Uhr schrieb rob:

>> Some nice recent adds.
>
>Wich groups were added?

<https://datatracker.ietf.org/doc/html/rfc3977#section-7.3>

Thus do:

printf '%s\r\n' 'NEWGROUPS 20230905 000000 GMT' 'QUIT' | openssl s_client -ign_eof -connect paganini.bofh.team:563
^^^^^^^^
adjust the date to your needs

HTH

BTW: Group "de.soc.dateschutz" seems to be a fault to me.
^^
Marcel
--
╭─╮ ╭──╮ ╭──╮ ╭─╮ ..52..╭─╮ ╭────╮
╭─╯ ╰─╯ ╰─╯ ╰───────╮ ╭───╮ ╭───╯ │ ╭─╮ ..52..│ ╰─╯ ╭─╯
╯ ..17..│ │ │ ╭─╯ ╰─╯ ╰─────────╮ ╰────╮ ╰────╮ ╭
╰───╯ ╰─╯ ╰───────╯..64..╰─╯

Marcel Logen <333200007110-0201@ybtra.de> wrote in
news:20231129we105006@o15.ybtra.de:

> Marco Moock in alt.free.newsservers:
>
>>Am 29.11.2023 um 09:08:12 Uhr schrieb rob:
>
>>> Some nice recent adds.
>>
>>Wich groups were added?
>
> <https://datatracker.ietf.org/doc/html/rfc3977#section-7.3>
>
> Thus do:
>
> printf '%s\r\n' 'NEWGROUPS 20230905 000000 GMT' 'QUIT' | openssl
> s_client -ign_eof -connect paganini.bofh.team:563
> ^^^^^^^^
> adjust the date to your needs
>
> HTH

Very handy, thanks.

> BTW: Group "de.soc.dateschutz" seems to be a fault to me.
> ^^
> Marcel

On this Sat, 2 Dec 2023 07:11:51 -0000 (UTC), timothy wrote:

>> <https://datatracker.ietf.org/doc/html/rfc3977#section-7.3>
>>
>> Thus do:
>>
>> printf '%s\r\n' 'NEWGROUPS 20230905 000000 GMT' 'QUIT' | openssl
>> s_client -ign_eof -connect paganini.bofh.team:563
>> ^^^^^^^^
>> adjust the date to your needs
>>
>> HTH
>
> Very handy, thanks.

It would be nice if it worked on Windows.

This works alone on Windows.
openssl s_client -ign_eof -connect paganini.bofh.team:563

Somehow we have to issue the newsgroup search.

This does not work.
openssl s_client -ign_eof -connect paganini.bofh.team:563|findstr NEWSGROUPS

On 12/5/23 14:05, Andrew wrote:
> It would be nice if it worked on Windows.

What about it doesn't work?

What error are you getting?

> This works alone on Windows.
> openssl s_client -ign_eof -connect paganini.bofh.team:563

That's a standard OpenSSL s_client connection.

> Somehow we have to issue the newsgroup search.
>
> This does not work.
> openssl s_client -ign_eof -connect paganini.bofh.team:563|findstr NEWSGROUPS

I'm not sure what that's supposed to do. I don't see anything going
into the openssl command.

I'd be surprised if findstr returns much from a simple connection with
no NNTP commands.

What happens if you echo / printf / etc. "newgroups ..." and pipe it
into the openssl command?

--
Grant. . . .

On 05/12/2023 21:13, Grant Taylor wrote:
>
> What happens if you echo / printf / etc. "newgroups ..." and pipe it
> into the openssl command?
>
>
>

That's my fault. The server certificate it's expired, and I missing to
renew.

Now it's working (I think)

Sincerely

--
Ivo Gandolfo

Ivo Gandolfo <usenet@bofh.team> writes:

> That's my fault. The server certificate it's expired, and I missing to
> renew.
>
> Now it's working (I think)

And if one doesn't fear a mitm for such simple queries, there is port 119
and netcat.

\o/ . o O ( rlwrap nc ... )

--
I do not bite, I just want to play.

Ivo Gandolfo in alt.free.newsservers:

>On 05/12/2023 21:13, Grant Taylor wrote:

>>What happens if you echo / printf / etc. "newgroups ..." and pipe it into
>>the openssl command?

>That's my fault.

I don't think so.

> The server certificate it's expired, and I missing to
>renew.
>
>Now it's working (I think)

Unfortunately not really:

| user15@o15:/tmp$ printf '%s\r\n' 'QUIT' | openssl s_client -ign_eof -connect paganini.bofh.team:563 -showcerts | openssl x509 -noout -dates -issuer -subject
| depth=0 CN = paganini.bofh.team
| verify error:num=20:unable to get local issuer certificate
^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
| verify return:1
| depth=0 CN = paganini.bofh.team
| verify error:num=21:unable to verify the first certificate
| verify return:1
| depth=0 CN = paganini.bofh.team
| verify return:1
| notBefore=Dec 5 17:58:37 2023 GMT
| notAfter=Mar 4 17:58:36 2024 GMT

OK: server certificate has been renewed

| issuer=C = US, O = Let's Encrypt, CN = R3

This intermediate cert is missing on your server IMHO.

| subject=CN = paganini.bofh.team
| user15@o15:/tmp$

<https://letsencrypt.org/certificates/>
<https://letsencrypt.org/certs/lets-encrypt-r3.pem>

Marcel
--
╭─╮ ╭──────╮ ╭──╮ ╭─────╮ ..42..╭──╮ ╭────╮ ╭───────╮
│ ╰─╮ ╰──╮ ╰───╮ ╭─╯ ╰─╮ ╰──╮ │ ..42..│ ╰─╯ ╭─╯ ╰────╮ ╰──╮
─╯ │ ╭─╯ ..14..╰───╯ ╭───╯ ╭───╯ │ ╭─╮ │ ╭────╯ ╭─╮ ╭─╯ │
╰───╯ ╰─────╯ ╰───╯ ╰─╯ ╰───────╯ ╰──╯ ..66..╰

Andrew in alt.free.newsservers:

>On this Sat, 2 Dec 2023 07:11:51 -0000 (UTC), timothy wrote:

>>> printf '%s\r\n' 'NEWGROUPS 20230905 000000 GMT' 'QUIT' | openssl s_client -ign_eof -connect paganini.bofh.team:563
>>> ^^^^^^^^
>>> adjust the date to your needs
>>>
>>> HTH
>>
>> Very handy, thanks.
>
>It would be nice if it worked on Windows.
>
>This works alone on Windows.
>openssl s_client -ign_eof -connect paganini.bofh.team:563

This is a good start point.

Then type (within ca. 10 seconds):

DATE

and hit the RETURN or ENTER key.

Additionally type

NEWGROUPS 20230905 000000 GMT

and hit the RETURN or ENTER key.

You should see the list of 'new' newsgroups since 2023, Sep 5.

BTW: NEWGROUPS, not NEWSGROUPS.

Then type

QUIT

and ENTER.

Marcel

On 05/12/2023 23:01, Marcel Logen wrote:
>
> This intermediate cert is missing on your server IMHO.
>
>
> Marcel

Ops... my mystake (again), i don't copy the fullchain.

Now it's done.

Sincerely

--
Ivo Gandolfo

yeti in alt.free.newsservers:

>And if one doesn't fear a mitm for such simple queries, there is port 119
>and netcat.

Yes, of course, it is simply a "confirmed habit" for me to use
openssl. :-)

printf '%s\r\n' 'NEWGROUPS 20230905 000000 GMT' 'QUIT' | nc paganini.bofh.team 119

works fine on my Linux system.

Marcel

Ivo Gandolfo in alt.free.newsservers:

>On 05/12/2023 23:01, Marcel Logen wrote:

>>This intermediate cert is missing on your server IMHO.

>Ops... my mystake (again), i don't copy the fullchain.
>
>Now it's done.

Works fine for me:

| Verify return code: 0 (ok)

Marcel

Grant Taylor wrote on Tue, 5 Dec 2023 14:13:53 -0600 :

> What about it doesn't work?
>
> What error are you getting?

I can't feed the newsgroup command to the openssl executable.
The "printf" is an invalid command in the Windows command line.

This is exactly what I got when I ran it just now from Windows.

openssl s_client -ign_eof -connect paganini.bofh.team:563
CONNECTED(000001B4)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = paganini.bofh.team
verify return:1
---
Certificate chain
0 s:CN = paganini.bofh.team
i:C = US, O = Let's Encrypt, CN = R3
1 s:C = US, O = Let's Encrypt, CN = R3
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF8TCCBNmgAwIBAgISBDfbutCnpCpAeBmmtmxngEo3MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMzEyMDUxNzU4MzdaFw0yNDAzMDQxNzU4MzZaMB0xGzAZBgNVBAMT
EnBhZ2FuaW5pLmJvZmgudGVhbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
ggIBAJ8TvHIVkPPhfGIp38EoRrLOwWzzMX6hhpUxWQxwYZU1AYn7yOVeUOGBpt0x
a2n8jKkjH9Xcc9m88Iwh0XfZD3pL2WH/Q6mPKTmFHcMZcHK/kW4BoFNqBZn2qfLE
n5O7v4EGXIYVn128DzCy0ecxT8MJ6ed7BqhjAsOsXNj2KWjHQ1IwI7DAttqUZBXC
LexRRG4rlED5cEbYvQelad5OVGaUGtpsutE9MbSiko/bNI/fJygBbXoRIu6i1fiA
EpavysJQvCb7deR7aUzMXclu2uJALbQrpZU8g5dc/D8DbOghqpifpWQ9YzZHmOvS
nwXblpTSHQD0MDUqlJ3K4GgQvsRGmSLtpqT9FrCgt5/t8zCrYFiePetditVGaOsS
MvT+NF4ljRuyvqPbHeQaRmm0pqHF76lfgV3pWQScgm9oxs+a+JeE2mim59ZbBgST
SPVxofRUoplFIFLvfwTAerlwJMN8wO+MboyKcJUb1zRabRMVgcEQIry5a6bvm3hs
Y6xV2bpHC8RdxDTVLSgXjrx2x5j4QFCqyq38GL1uofsHPj143t9bF829ujKCEyzU
tJ6f9p0lLkgBtoF8OKRP2IK5CL7ttTWWBn0thhAarrxcI8lopQhdEywIbBmYhZnI
rNJ5QrkSNB7YmiCtYJ1mdhbWw/y4b1lZwCqUeeNK1vAmhwFvAgMBAAGjggIUMIIC
EDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCMLBfjmz5MGOZAk+0lyln3W2rJOMB8G
A1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAh
BggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZo
dHRwOi8vcjMuaS5sZW5jci5vcmcvMB0GA1UdEQQWMBSCEnBhZ2FuaW5pLmJvZmgu
dGVhbTATBgNVHSAEDDAKMAgGBmeBDAECATCCAQQGCisGAQQB1nkCBAIEgfUEgfIA
8AB2AEiw42vapkc0D+VqAvqdMOscUgHLVt0sgdm7v6s52IRzAAABjDtYs0MAAAQD
AEcwRQIgNBXCeBmXQLuZ0xcUWuJ888r7gh/OpkVvN95V/f0m5z8CIQC1FzCwu9rH
vZ4aIfl/Yz9J4Q6oqxpu5feueIX94LWTnAB2AHb/iD8KtvuVUcJhzPWHujS0pM27
KdxoQgqf5mdMWjp0AAABjDtYs5wAAAQDAEcwRQIhAKOkHcpABwTUHcPby4ZUhgKx
2OYTdIBkA05eOuYeGX+qAiBTRCHsPjXW4o1QrX3k1gsUQiD8ARUTJRtNK/SEJ5bQ
sjANBgkqhkiG9w0BAQsFAAOCAQEAe7Y7xRJ6QagcvGVS3r9esePrex05k3p/3Avu
qUHAYpl7PROUVc3norZ8WR5lZPVUuv/3KHL3t0sfPRVD2cIxaLYkq0DyoFiswZ1r
PM0GIhp6P+WNbRgK2vf1183ukshhtuC2zsWD4QXm4naO8MLCG7aGhZJDitfpT8Hw
fQTcaxq7hpirR2kaFrEbW2rhOcEFIubL+3lYdtgYqHWOdFuezddcFwh2qiJ1Bl2M
YuTDBO44F5v0NoDnDu2mQzNHYi82L594G3+JN+3IMDMKq2Ck+vfLiYlGiA1pcdCg
OeF7iKxq4llb4Iul/4OQLNu/6EaK6WqMvQZP/tK1ENA6iZBCVQ==
-----END CERTIFICATE-----
subject=CN = paganini.bofh.team

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 5033 bytes and written 400 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: B41A3E729829491A1E9A3393FE8F054A3DD84492394DBBAA99545327DA2A9C54
Session-ID-ctx:
Resumption PSK: 502D14DC1121CBD087722D1A9D17DBEDCD9DA3E13680AEFA779AF910505A0E075DBD6FF02DCBC49F61918BA0AD64B9AB
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 9c 13 86 f6 67 7e 2b 3c-f5 87 f2 e7 e7 ed fa 1a ....g~+<........
0010 - 45 9a c2 07 d7 98 54 c1-44 04 84 86 03 94 94 9b E.....T.D.......
0020 - 75 66 d9 4d 23 2e 1f 75-6f b8 b4 07 9f 44 d6 f8 uf.M#..uo....D..
0030 - 2e 56 e1 b8 ef 29 05 65-60 57 71 ee 73 79 87 eb .V...).e`Wq.sy..
0040 - 21 69 b3 37 2b f0 a4 e6-e8 df fe ab 28 d2 b6 02 !i.7+.......(...
0050 - 4a 28 61 9f 67 25 43 a3-df 3c 2f d1 e3 a2 a5 dc J(a.g%C..</.....
0060 - 82 47 b0 a2 b9 07 35 68-eb d5 fa 80 35 ca 45 fb .G....5h....5.E.
0070 - c3 21 51 bc eb 79 a6 ec-b9 87 f4 5e 2d aa 33 eb .!Q..y.....^-.3.
0080 - b2 ad 71 60 39 02 b7 0b-b1 ea a0 91 6f 93 b6 91 ..q`9.......o...
0090 - 71 bb c0 bd e0 2b 3c 70-49 3d dd cb e4 66 2f 16 q....+<pI=...f/.
00a0 - e9 83 76 ea da 88 6a f8-cf dd bf 47 b2 72 a1 3c ..v...j....G.r.<
00b0 - 79 d8 be ae 01 f4 17 05-bf c9 ae e2 aa 9b 2d 33 y.............-3
00c0 - 7a 79 02 a5 3b 0c c3 21-a4 e8 98 2d a7 51 b5 b8 zy..;..!...-.Q..

Start Time: 1701815986
Timeout : 7200 (sec)
Verify return code: 20 (unable to get local issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 05BD038E2F4B5ED3AADE9F6C47A5CF20959B8D072DB3B40D0CED36AC027DE531
Session-ID-ctx:
Resumption PSK: 767BC227656F044F5480C7ABE2AE15F3026A21025DF03CD80E30750F3086BE268CD67A19533F3CD12F1D8BC82CD1185C
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - 9c 13 86 f6 67 7e 2b 3c-f5 87 f2 e7 e7 ed fa 1a ....g~+<........
0010 - e7 71 c6 e1 dc 1f a5 31-68 e2 1d 56 50 77 26 f8 .q.....1h..VPw&.
0020 - b3 04 92 2b 44 3d 92 ba-4d 50 4a f6 99 45 93 66 ...+D=..MPJ..E.f
0030 - c9 a2 c4 1b 88 d3 8c 34-c8 f4 1c 58 b5 ea c0 eb .......4...X....
0040 - 75 0f b1 7e cf 2f 94 52-b0 50 e1 1c d2 67 84 75 u..~./.R.P...g.u
0050 - dd 61 f7 b5 74 a8 97 5d-ff 7c 3f da aa ee 10 71 .a..t..].|?....q
0060 - f2 22 7e ff 16 09 82 ce-25 8e 39 4e 47 07 44 5c ."~.....%.9NG.D\
0070 - 61 ef 58 45 9e b3 9b 2c-f5 41 41 a6 a4 03 3c 0a a.XE...,.AA...<.
0080 - 7d 60 c0 b0 6e 83 83 cd-dc 5d c8 ce 50 a3 fc a3 }`..n....]..P...
0090 - 04 96 44 6e 1e d9 c7 dc-ca b0 84 d5 3a 10 0a a6 ..Dn........:...
00a0 - db 2f e6 43 e5 a3 7e da-eb b4 8b 94 c4 0c fc 1c ./.C..~.........
00b0 - 51 4c b8 9f c4 a6 83 3f-73 77 c4 58 29 5d b8 a7 QL.....?sw.X)]..
00c0 - e7 36 49 31 c2 2f 10 e6-62 e7 88 d4 2c 32 e9 b2 .6I1./..b...,2..

Start Time: 1701815987
Timeout : 7200 (sec)
Verify return code: 20 (unable to get local issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
200 paganini.bofh.team InterNetNews NNRP server INN 2.6.4 ready (posting ok)

quit
205 Bye!
closed

That's it.
But wasn't I trying to get the newsgroups that are served?

Marcel Logen wrote on Tue, 5 Dec 2023 23:34:11 +0100 :

>>This works alone on Windows.
>>openssl s_client -ign_eof -connect paganini.bofh.team:563
>
> This is a good start point.
>
> Then type (within ca. 10 seconds):
>
> DATE
>
> and hit the RETURN or ENTER key.
>
> Additionally type
>
> NEWGROUPS 20230905 000000 GMT
>
> and hit the RETURN or ENTER key.
>
> You should see the list of 'new' newsgroups since 2023, Sep 5.
>
> BTW: NEWGROUPS, not NEWSGROUPS.
>
> Then type
>
> QUIT
>
> and ENTER.
>
> Marcel

That worked perfect!
Thanks.

c:\> openssl s_client -ign_eof -connect paganini.bofh.team:563
Type "DATE"
Type "NEWGROUPS 20230905 000000 GMT"

This is the result.

openssl s_client -ign_eof -connect paganini.bofh.team:563

CONNECTED(000001B4)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = paganini.bofh.team
verify return:1
---
Certificate chain
0 s:CN = paganini.bofh.team
i:C = US, O = Let's Encrypt, CN = R3
1 s:C = US, O = Let's Encrypt, CN = R3
i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
i:O = Digital Signature Trust Co., CN = DST Root CA X3
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF8TCCBNmgAwIBAgISBDfbutCnpCpAeBmmtmxngEo3MA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMzEyMDUxNzU4MzdaFw0yNDAzMDQxNzU4MzZaMB0xGzAZBgNVBAMT
EnBhZ2FuaW5pLmJvZmgudGVhbTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoC
ggIBAJ8TvHIVkPPhfGIp38EoRrLOwWzzMX6hhpUxWQxwYZU1AYn7yOVeUOGBpt0x
a2n8jKkjH9Xcc9m88Iwh0XfZD3pL2WH/Q6mPKTmFHcMZcHK/kW4BoFNqBZn2qfLE
n5O7v4EGXIYVn128DzCy0ecxT8MJ6ed7BqhjAsOsXNj2KWjHQ1IwI7DAttqUZBXC
LexRRG4rlED5cEbYvQelad5OVGaUGtpsutE9MbSiko/bNI/fJygBbXoRIu6i1fiA
EpavysJQvCb7deR7aUzMXclu2uJALbQrpZU8g5dc/D8DbOghqpifpWQ9YzZHmOvS
nwXblpTSHQD0MDUqlJ3K4GgQvsRGmSLtpqT9FrCgt5/t8zCrYFiePetditVGaOsS
MvT+NF4ljRuyvqPbHeQaRmm0pqHF76lfgV3pWQScgm9oxs+a+JeE2mim59ZbBgST
SPVxofRUoplFIFLvfwTAerlwJMN8wO+MboyKcJUb1zRabRMVgcEQIry5a6bvm3hs
Y6xV2bpHC8RdxDTVLSgXjrx2x5j4QFCqyq38GL1uofsHPj143t9bF829ujKCEyzU
tJ6f9p0lLkgBtoF8OKRP2IK5CL7ttTWWBn0thhAarrxcI8lopQhdEywIbBmYhZnI
rNJ5QrkSNB7YmiCtYJ1mdhbWw/y4b1lZwCqUeeNK1vAmhwFvAgMBAAGjggIUMIIC
EDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMC
MAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCMLBfjmz5MGOZAk+0lyln3W2rJOMB8G
A1UdIwQYMBaAFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAh
BggrBgEFBQcwAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZo
dHRwOi8vcjMuaS5sZW5jci5vcmcvMB0GA1UdEQQWMBSCEnBhZ2FuaW5pLmJvZmgu
dGVhbTATBgNVHSAEDDAKMAgGBmeBDAECATCCAQQGCisGAQQB1nkCBAIEgfUEgfIA
8AB2AEiw42vapkc0D+VqAvqdMOscUgHLVt0sgdm7v6s52IRzAAABjDtYs0MAAAQD
AEcwRQIgNBXCeBmXQLuZ0xcUWuJ888r7gh/OpkVvN95V/f0m5z8CIQC1FzCwu9rH
vZ4aIfl/Yz9J4Q6oqxpu5feueIX94LWTnAB2AHb/iD8KtvuVUcJhzPWHujS0pM27
KdxoQgqf5mdMWjp0AAABjDtYs5wAAAQDAEcwRQIhAKOkHcpABwTUHcPby4ZUhgKx
2OYTdIBkA05eOuYeGX+qAiBTRCHsPjXW4o1QrX3k1gsUQiD8ARUTJRtNK/SEJ5bQ
sjANBgkqhkiG9w0BAQsFAAOCAQEAe7Y7xRJ6QagcvGVS3r9esePrex05k3p/3Avu
qUHAYpl7PROUVc3norZ8WR5lZPVUuv/3KHL3t0sfPRVD2cIxaLYkq0DyoFiswZ1r
PM0GIhp6P+WNbRgK2vf1183ukshhtuC2zsWD4QXm4naO8MLCG7aGhZJDitfpT8Hw
fQTcaxq7hpirR2kaFrEbW2rhOcEFIubL+3lYdtgYqHWOdFuezddcFwh2qiJ1Bl2M
YuTDBO44F5v0NoDnDu2mQzNHYi82L594G3+JN+3IMDMKq2Ck+vfLiYlGiA1pcdCg
OeF7iKxq4llb4Iul/4OQLNu/6EaK6WqMvQZP/tK1ENA6iZBCVQ==
-----END CERTIFICATE-----
subject=CN = paganini.bofh.team

issuer=C = US, O = Let's Encrypt, CN = R3

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 5033 bytes and written 400 bytes
Verification error: unable to get local issuer certificate
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 20 (unable to get local issuer certificate)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 11BF11777FF1A17A4625882C76AC491BD6F9B83E858B98D0EC3529CA9DFE660F
Session-ID-ctx:
Resumption PSK: 17B8972C749AF75D4C2DABE0411F66C64B1B0BAB24A7EFD0A76B9D826E07CCE00B327E3C16BED9B4EB0A4809FE134B58
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - a2 5b 2e db ed a5 8e e5-6a 66 81 10 5a 06 54 a5 .[......jf..Z.T.
0010 - b1 84 69 28 27 39 a0 63-d6 b0 f8 da 73 2c 83 8c ..i('9.c....s,..
0020 - 2f 25 6e 8c fb f2 05 97-7a 45 cd a7 f8 0c a4 97 /%n.....zE......
0030 - b9 10 8f 9f f4 13 91 e3-a0 66 6a de c0 d1 7c 63 .........fj...|c
0040 - 46 46 0e e7 8c 79 73 c2-ed 95 6f 54 46 7a 41 9f FF...ys...oTFzA.
0050 - 27 64 73 5a 9d fe 44 d0-5d ca 69 af 3d 05 96 9c 'dsZ..D.].i.=...
0060 - 0a 25 97 dc ef c8 18 ea-90 5e e9 92 7e 3f 1b 45 .%.......^..~?.E
0070 - 23 b3 c3 b2 0c fe 36 12-91 bb f4 aa e6 dd e0 9c #.....6.........
0080 - bc cd 79 c0 54 7f 54 9e-6d e8 59 1c 2f c4 dc 1f ..y.T.T.m.Y./...
0090 - 5f 0c 1d 00 c6 23 50 74-0e 7e ea c4 b9 35 05 aa _....#Pt.~...5..
00a0 - 8c ec 24 64 26 ea 7b bb-ab e3 e3 f1 97 b1 34 ff ..$d&.{.......4.
00b0 - c0 eb 13 83 81 51 ec f0-cd ee 02 b1 8d f7 1d ac .....Q..........
00c0 - 5e 12 54 94 dd 3a 7c a4-95 73 6b ac ee 25 32 db ^.T..:|..sk..%2.

Start Time: 1701816942
Timeout : 7200 (sec)
Verify return code: 20 (unable to get local issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 58B7500CFE74AEBEE7A0021D17BE7F4260A0D4A16A03129DEE19F26E2F14693B
Session-ID-ctx:
Resumption PSK: D54C133041D946EB0881774651B748A43791FC6DCF26FA527B5C61CD30F75E05E900A6C370B93E4A7BE7BF4FF7BFD5A0
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 7200 (seconds)
TLS session ticket:
0000 - a2 5b 2e db ed a5 8e e5-6a 66 81 10 5a 06 54 a5 .[......jf..Z.T.
0010 - 6c 4a 3c 9f 39 f7 0f c8-fa e4 c1 dd cd 88 38 a4 lJ<.9.........8.
0020 - 79 6a 0e 65 23 fa 8e d2-07 af 85 a5 6d 55 bf a3 yj.e#.......mU..
0030 - ec 0b 5c eb 28 cd 3a f7-08 17 b3 8b da 7f 46 7c ..\.(.:.......F|
0040 - 49 16 56 30 87 50 32 94-c4 69 64 69 f3 be ac d8 I.V0.P2..idi....
0050 - 79 f0 3c 58 14 dd f1 13-1f 5a 15 03 4b c6 dc 8d y.<X.....Z..K...
0060 - 05 e2 37 6b 27 3f cb f0-50 81 93 98 bf 80 a7 92 ..7k'?..P.......
0070 - 88 25 7b 9c 2c a3 41 e7-10 fb ce 1c f8 63 40 19 .%{.,.A......c@.
0080 - 31 88 97 de 4f ce b0 1a-53 ee fe 39 38 2c 53 2f 1...O...S..98,S/
0090 - 2b d4 60 57 d2 00 93 9f-57 87 6c ff a8 6c 19 8f +.`W....W.l..l..
00a0 - c4 39 d1 cb 17 6f dc ed-ff d0 bf 3e b5 16 43 30 .9...o.....>..C0
00b0 - e7 42 47 dd 65 1b 72 98-44 c9 8a 94 4f 75 15 3d .BG.e.r.D...Ou.=
00c0 - 96 8c 7d cb 4c 51 8f af-08 b2 90 c1 1f ee 1e da ..}.LQ..........

Start Time: 1701816942
Timeout : 7200 (sec)
Verify return code: 20 (unable to get local issuer certificate)
Extended master secret: no
Max Early Data: 0
---
read R BLOCK
200 paganini.bofh.team InterNetNews NNRP server INN 2.6.4 ready (posting ok)
DATE

111 20231205225545

NEWGROUPS 20230905 000000 GMT

231 New newsgroups follow
alt.binaries.ebook.flood 33 28 y
fr.soc.histoire.medievale 3 3 y
abq.for-sale 0 1 y
alive.sports 13476 1 y
alt.entertainment 13194 1 y
misc.business 12146 1 y
sci.technology 8727 1 y
general 17144 1 y
own.health 8870 1 y
sci.science 4704 1 y
alt.binaries.ebooks 121 102 y
alt.binaries.dutch.ebook 3 4 y
alt.binaries.sacd.iso 1 2 y
alt.binaries.multimedia.nospam.erotica 0 1 y
alt.binaries.hdtv.reposts 0 1 y
clari.news.politics.people 2 1 y
alt.binaries.e-book-flood 67 57 y
cna.politics.mainland 0 1 y
kraft.binary 0 1 y
alt.binaries.sounds.lossless.1980s 15 13 y
de.soc.dateschutz 4 1 y
grk.jokes 0 1 y
hispagatos.ayuda 27 1 y
hispagatos.test 13 1 y
free.dumbass.gavin-newsom 1 1 y
free.moron.karen-bass 1 1 y
..
quit
205 Bye!
closed

Marcel Logen wrote on Tue, 5 Dec 2023 23:43:03 +0100 :

>>Now it's done.
>
> Works fine for me:

Here's what I get on Windows after you sent that.
c:\> openssl s_client -ign_eof -connect paganini.bofh.team:563 -showcerts | openssl x509 -noout -dates -issuer -subject

depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = paganini.bofh.team
verify return:1
notBefore=Dec 5 17:58:37 2023 GMT
notAfter=Mar 4 17:58:36 2024 GMT
issuer=C = US, O = Let's Encrypt, CN = R3
subject=CN = paganini.bofh.team

Does that mean it's working now for me also?

On 12/5/23 16:39, Marcel Logen wrote:
> works fine on my Linux system.

I've actually had OpenSSL fail on a Linux system when the same command
worked just fine on a Windows system.

It was a very specific / esoteric case having to do with the <CR><LF>
that Windows uses and the <LF> that Linux uses.

The service was coded per RFC to REQUIRE <CR><LF> for end of line and
didn't see <LF> as sufficient.

That's where the -crlf option for 's_client comes into play.

Interesting times.

That was difficult to debug too because I had to capture ephemeral keys
and decrypt the TLS stream. #funTimes #learningOpportunity

--
Grant. . . .

On 12/5/23 16:44, Andrew wrote:
> I can't feed the newsgroup command to the openssl executable.
> The "printf" is an invalid command in the Windows command line.

Try "echo NEWGROUPS" (adjust for proper parameters as desired) into openssl.

I'm only mildly surprised that there isn't a printf command on (the
version of) Windows (that you're using).

> This is exactly what I got when I ran it just now from Windows.

ACK

From a cursory glance, that looks good to me. -- I've not verified
any of the X.509 cert stuff.

> That's it.
> But wasn't I trying to get the newsgroups that are served?

Try the "LIST ACTIVE" and / or "LIST NEWSGROUPS" NNTP commands.

See RFC 3977 for more details on the difference between the two.

Link - RFC 3977 - Network News Transfer Protocol
- https://datatracker.ietf.org/doc/html/rfc3977

Link - RFC 3977 - Network News Transfer Protocol - section 7.6.3 - LIST
ACTIVE
- https://datatracker.ietf.org/doc/html/rfc3977#section-7.6.3

Link - RFC 3977 - Network News Transfer Protocol - section 7.6.6 - LIST
NEWSGROUPS
- https://datatracker.ietf.org/doc/html/rfc3977#section-7.6.6

--
Grant. . . .

Andrew in alt.free.newsservers:

>Here's what I get on Windows after you sent that.
>c:\> openssl s_client -ign_eof -connect paganini.bofh.team:563 -showcerts | openssl x509 -noout -dates -issuer -subject
>
>depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
>verify error:num=20:unable to get local issuer certificate
^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Issuer is "DST Root CA X3", but *this* certificate has expired
on 2021, Sep 30:

<https://www.identrust.com/support/downloads>, there at bottom.

I don't know what the right solution is.

Perhaps Ivo could install the "ISRG Root X1" *self-signed* cert
from Let's Encrypt. (?)

| user15@o15:/tmp$ openssl x509 -in ISRG_Root_X1.crt -noout -dates -issuer -subject
| notBefore=Jun 4 11:04:38 2015 GMT
| notAfter=Jun 4 11:04:38 2035 GMT
| issuer=C = US, O = Internet Security Research Group, CN = ISRG Root X1
| subject=C = US, O = Internet Security Research Group, CN = ISRG Root X1

<https://letsencrypt.org/certificates/>
<https://letsencrypt.org/certs/isrgrootx1.txt>
<https://letsencrypt.org/certs/isrgrootx1.pem>

The remainder seems OK to me:

>depth=1 C = US, O = Let's Encrypt, CN = R3
>verify return:1
>depth=0 CN = paganini.bofh.team
>verify return:1
>notBefore=Dec 5 17:58:37 2023 GMT
>notAfter=Mar 4 17:58:36 2024 GMT
>issuer=C = US, O = Let's Encrypt, CN = R3
>subject=CN = paganini.bofh.team
>
>Does that mean it's working now for me also?

Not yet really, I think.

Marcel

Marcel Logen in alt.free.newsservers:

>Andrew in alt.free.newsservers:

>>depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
>>verify error:num=20:unable to get local issuer certificate
> ^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>Issuer is "DST Root CA X3", but *this* certificate has expired
>on 2021, Sep 30:
[...]
>I don't know what the right solution is.
>
>Perhaps Ivo could install the "ISRG Root X1" *self-signed* cert
>from Let's Encrypt. (?)

Or no "ISRG Root X1" cert at all. "ISRG Root X1" could/should be
in the local "trust store". (?)

Marcel